OPENSUSE-SU-2026:11054-1 containerized-data-importer-1.65-api-1.65.0-1.1 on GA media

These are all security issues fixed in the containerized-data-importer-1.65-api-1.65.0-1.1 package on the GA media of openSUSE Tumbleweed...

SUSE-SU-2026:2407-1 Security update for containerized-data-importer

This update for containerized-data-importer rebuilds the current sources against latest go security release and the images against the latest released updates...

CVE-2026-33814 affecting package containerized-data-importer for versions less than 1.62.0-6

CVE-2026-33814 affecting package containerized-data-importer for versions less than 1.62.0-6. A patched version of the package is available...

CVE-2026-25681 affecting package containerized-data-importer for versions less than 1.62.0-5

CVE-2026-25681 affecting package containerized-data-importer for versions less than 1.62.0-5. A patched version of the package is available...

CVE-2026-25680 affecting package containerized-data-importer for versions less than 1.62.0-5

CVE-2026-25680 affecting package containerized-data-importer for versions less than 1.62.0-5. A patched version of the package is available...

CVE-2026-42502 affecting package containerized-data-importer for versions less than 1.62.0-5

CVE-2026-42502 affecting package containerized-data-importer for versions less than 1.62.0-5. A patched version of the package is available...

CVE-2026-42506 affecting package containerized-data-importer for versions less than 1.62.0-5

CVE-2026-42506 affecting package containerized-data-importer for versions less than 1.62.0-5. A patched version of the package is available...

CVE-2026-27136 affecting package containerized-data-importer for versions less than 1.62.0-5

CVE-2026-27136 affecting package containerized-data-importer for versions less than 1.62.0-5. A patched version of the package is available...

CVE-2026-39821 affecting package containerized-data-importer for versions less than 1.62.0-5

CVE-2026-39821 affecting package containerized-data-importer for versions less than 1.62.0-5. A patched version of the package is available...

AZL-87546 CVE-2026-42506 affecting package containerized-data-importer for versions less than 1.62.0-6

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-87549 CVE-2026-42502 affecting package containerized-data-importer for versions less than 1.62.0-6

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-87558 CVE-2026-27136 affecting package containerized-data-importer for versions less than 1.62.0-6

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-87543 CVE-2026-39821 affecting package containerized-data-importer for versions less than 1.62.0-6

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode"xn--example-.com" incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna...

AZL-87555 CVE-2026-25681 affecting package containerized-data-importer for versions less than 1.62.0-6

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-87561 CVE-2026-25680 affecting package containerized-data-importer for versions less than 1.62.0-6

Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service...

FPDI: Memory Exhaustion and Endless Loop in FPDI leads to Denial of Service

Impact This is a significant Denial of Service DoS vulnerability. Any application that uses FPDI to process user-supplied PDF files is at risk. An attacker can upload a small, malicious PDF file that will cause the server-side script to crash due to memory exhaustion or a script time-out. Repeate...

CVE-2026-35469 affecting package containerized-data-importer for versions less than 1.62.0-4

CVE-2026-35469 affecting package containerized-data-importer for versions less than 1.62.0-4. A patched version of the package is available...

CVE-2026-32288 affecting package containerized-data-importer for versions less than 1.62.0-3

CVE-2026-32288 affecting package containerized-data-importer for versions less than 1.62.0-3. A patched version of the package is available...

AZL-86448 CVE-2026-33814 affecting package containerized-data-importer for versions less than 1.62.0-6

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGSMAXFRAMESIZE with a value of 0...

AZL-85628 CVE-2026-35469 affecting package containerized-data-importer for versions less than 1.62.0-6

spdystream is a Go library for multiplexing streams over SPDY connections. In versions 0.5.0 and below, the SPDY/3 frame parser does not validate attacker-controlled counts and lengths before allocating memory. Three allocation paths are affected: the SETTINGS frame entry count, the header count ...